Xrdp: How to make Manjaro (KDE 5) work as a xrdp server?

[eduardolucioac]

Simple question, but difficult to solve... So far... =|

How to make Manjaro (KDE 5) work as a xrdp server?

NOTE: We really like the xrdp protocol and have used it in the past with other Linux distros (Ubuntu) as a server, but we are having a hard time getting xrdp to work on Manjaro (KDE) as a server.

Thanks! =D

INTERESTING LINKS ABOUT THE SUBJECT:
https://forum.manjaro.org/t/xrdp-cant-get-plasma-to-start-after-initial-logging-into-xrdp-xorg-session/110678
https://forum.manjaro.org/t/not-able-to-rdp-from-windows-to-manjaro-vm-via-xrdp-xorg/94357/2
https://wiki.archlinux.org/index.php/xrdphttps://www.hiroom2.com/2019/06/15/ubuntu-1904-xrdp-kde-en/
https://www.hiroom2.com/2019/06/15/ubuntu-1904-xrdp-kde-en/
https://superuser.com/questions/1509055/manjaro-kde-running-as-a-rdp-server
https://forum.manjaro.org/t/manjaro-kde-running-as-a-rdp-server/114561

[koranza]

The following worked for me, using Manjaro KDE (manjaro-kde-20.2-201207-linux59.iso)

1. Install xrdp and xorgxrdp-git from AUR
   (Note: there is also a xrdp-git package available. That also worked for me, as an alternative to xrdp)

sudo pacman -S yay                        # install an AUR helper
yay -S aur/xrdp aur/xorgxrdp-git          # install xrdp from AUR

1. Add allowed_users=anybody to /etc/X11/Xwrapper.config to allow anybody to start X.
   (Note: This step was taken from https://wiki.archlinux.org/index.php/xrdp. I had to create that file since it did not previously exist.)

2. important: Do either Option A or Option B as a workaround

Option A) Modify /etc/xrdp/startwm.sh, the start script that xrdp uses when logging in, to avoid calling . ~/.xinitrc.
(Note: This step was taken from https://github.com/neutrinolabs/xrdp/issues/1554#issuecomment-674868428 . I only had to modify the start script though, I did not modify sesman.ini at all)

file: /etc/xrdp/startwm.sh

  # arch user
  if [ -r ~/.xinitrc ]; then
    #. ~/.xinitrc                          # <-- Do not call this line; it will crash
    eval $(dbus-launch --sh-syntax)        # Add these 2 lines, in order to...
    startplasma-x11                        # ...start plasma directly instead of calling . ~/.xinitrc
    exit 0
  fi

Option B) Modify ~/.xinitrc to fix a bug + alter the dbus command. The bug* is that startkde is used instead of startplasma-x11 in 2 places (only showing 1 place below). Then alter dbus-args to remove --exit-with-session flag; if you don't, you will see the desktop environment start to load but it will hang.

file: ~/.xinitrc

#DEFAULT_SESSION=startkde                 # <-- bug, the startkde command no longer exists
DEFAULT_SESSION=startplasma-x11

and

get_session(){
    #local dbus_args=(--sh-syntax --exit-with-session)    # <-- the '--exit-with-session' flag causes hang
    local dbus_args=(--sh-syntax)

1. Enable and Start the xrdp + xrdp-sesman services. If you had them already running, restart them.

sudo systemctl enable xrdp
sudo systemctl enable xrdp-sesman
sudo systemctl start xrdp
sudo systemctl start xrdp-sesman

1. Get the ip address of your machine, which is now running xrdp. (look for inet [ipaddress] in the output)

ip address

1. From another machine, run a Remote Desktop client with the ip address from the machine that's running xrdp.

rdesktop -u [username] [ipaddress]

Notes

• I'm not sure which workaround is better; both worked for me and didn't break things after a reboot.
• It seems like the main issue may be with Manjaro's ~/.xinitrx file. Ideally, Manjaro would fix this issue on its end rather than end users making changes. Where are bugs tracked for manjaro kde? Is this it https://gitlab.manjaro.org/profiles-and-settings/manjaro-kde-settings/-/issues/9?
• If you get the username / password wrong, the login will fail. If you run sudo systemctl status xrdp-sesman from the machine running xrdp, the log will be obvious about it, with entries mentioning pam_faillock(xrdp-sesman:auth): User unknown and pam_unix(xrdp-sesman:auth): authentication failure;
• Is there anyway to improve error reporting/logging from xrdp's side of things for errors in startwm.sh though? What if another line in startwm.sh crashes in the future?
• There is a similar issue about xrdp not working (https://github.com/neutrinolabs/xrdp/issues/1684), which suggest modifying a line in /etc/pam.d/system-auth. I tried this suggestion, but it seemed worse because there are then popups asking for permission when I log in (for Network/wifi I think). Also, the sound devices were different -- with the modification, I see the same sound devices that I see when logged into the machine locally/normally; without the modification, I do not see any sound devices. I'm not sure what is more correct, haven't even explored how to get sound to work yet.

[matt335672]

Thanks for that @koranza - that may well be useful to some other users.

Regarding your last point on (#1684), it's possible your polkit isn't working properly when you DONT see the popups. That may be OK for you and your use case, but other KDE users have problems without polkit - see #1773 and #1709.

[agowa338]

Note: Because of #1684 one also wants to edit /etc/pam.d/system-auth and add a leading "#" to all lines containing "pam_systemd_home.so" or otherwise the systemd user daemon won't start and stuff like ssh-agent, dbus and audio may not work. (This obviously disables systemd-home, so this only works if you don't use it)

Note2: Instead of option A and B, there is a simple other way, for me the file ~/.xinitrc didn't exist at all, in that case just putting this in there will also work:

#!/bin/sh
exec startplasma-x11

And because we worked around #1684 systemd will take care of starting dbus for us. Therefore we don't need to execute eval $(dbus-launch --sh-syntax) manually

Note3: And for kwallet and gnome keyring to work (yes I need both because of applications that support either or and I need both applications) one also needs to edit /etc/pam.d/xrdp-sesman to initialize them upon login:

#%PAM-1.0

auth            include         system-remote-login
-auth           optional        pam_gnome_keyring.so
-auth           optional        pam_kwallet5.so

account         include         system-remote-login

password        include         system-remote-login
-password       optional        pam_gnome_keyring.so use_authtok

session         optional        pam_keyinit.so force revoke
session         include         system-remote-login
-session        optional        pam_gnome_keyring.so auto_start
-session        optional        pam_kwallet5.so auto_start

this is equivalent to how it would be configured with sddm, so either add it to both files, or directly within the include chain within /etc/pam.d/system-login.